Law / United States / 
New York
Public Service Commission Information Technology Cybersecurity Requirements, covered entity program duties
16 NYCRR Part 1200, secs. 1200.2 to 1200.20
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a covered entity: a public utility company as defined in subdivision 23 of section 2 of the Public Service Law (electric, gas, steam and water-works companies), except a water-works corporation serving fewer than 50,001 service connections, an electric corporation maintaining fewer than 50,000 service lines, a gas corporation that is a small business under the State Administrative Procedure Act, a telephone or telegraph corporation, and a municipal corporation. Declare operates_essential_service if your organization is such a utility; the Part covers information technology and not operational technology.
- Maintain a written cybersecurity program based on your risk assessment that identifies and assesses risks, protects your information technology, detects, responds to and recovers from cybersecurity events, and fulfills regulatory reporting obligations, and give the Director of the Department of Public Service's Office of Resilience, Utility Security, Nuclear Affairs and Emergency Preparedness your program documentation within 10 calendar days of a request (section 1200.2).
- Implement a written cybersecurity policy approved by a senior officer or your board covering the areas section 1200.3 lists, designate a qualified Chief Information Security Officer, and have that officer report in writing to your board at least yearly (sections 1200.3 and 1200.4).
- Run continuous monitoring or, absent it, penetration testing at least every 12 months and vulnerability assessments at least every six months, and carry out a documented risk assessment at least once every two years (sections 1200.5 and 1200.9).
- Limit and yearly review user access privileges, require multi-factor authentication for access to your internal networks from an external network unless your Chief Information Security Officer approves equivalent controls in writing, encrypt nonpublic information in transit and at rest or use compensating controls your Chief Information Security Officer approves, and give all personnel annual cybersecurity awareness training (sections 1200.7, 1200.12, 1200.14 and 1200.15).
- Keep a written incident response plan, test it at least yearly with a tabletop or similar exercise, hold a contract with a qualified third-party forensic vendor, and have a forensic report prepared after a suspected cybersecurity incident (sections 1200.16 and 1200.19).
- Have a qualified auditor perform a third-party cybersecurity audit every year and make it available to the Director by September 15, and submit to cybersecurity audits by Department staff on request, not more than yearly (sections 1200.17 and 1200.18).
- Contract in advance with a credit monitoring service and offer it, paid for by you or another responsible party for at least one year, to each person you must notify of a breach under General Business Law 899-aa (section 1200.20).
- Comply from , with 180 days to comply with most requirements and one year or eighteen months for the sections section 1200.25 names (sections 1200.24 and 1200.25).
These lines are LexLint's reading of the law's text, as of .
What this law does
Part 1200 of Title 16 NYCRR binds a covered entity, which means any public utility company as defined in subdivision 23 of section 2 of the Public Service Law other than the small, municipal, telephone and telegraph operators it lists. Each covered entity must maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the covered entity’s information technology.
Each covered entity must implement and maintain a written cybersecurity policy approved by a senior officer, its board of directors or an equivalent governing body. Each covered entity must designate a qualified individual responsible for overseeing and implementing its cybersecurity program and enforcing its cybersecurity policy.
Absent effective continuous monitoring, a covered entity must conduct penetration testing at least every 12 months and vulnerability assessments at least every six months. Multi-factor authentication must be utilized for any authorized user accessing the covered entity’s internal networks from an external network, unless the chief information security officer has approved reasonably equivalent or more secure access controls in writing.
Each covered entity must test its cybersecurity incident response plan at least yearly through a tabletop or other exercise simulating a network breach and compromise of nonpublic information. On a yearly basis, covered entities must cause to be conducted a third-party audit of the cybersecurity of their information technology and nonpublic information. The information technology that Part 1200 covers does not include operational technology.
Covered entities have 180 days from the effective date of Part 1200 to comply with its requirements, except as otherwise specified. Part 1200 is effective .
When LexLint raises it
When your app profile says your app runs an essential service.